sctp_outq_sack sctp_check_transmitted SKB was moved to outq->sack then throw away the sack queue SKB was deleted from outq->sack(but the datamsg held SKB at sctp_datamsg_to_asocSo, sctp_wfree was not called to destroy SKB)

then migrate happened

sctp_for_each_tx_datachunk( sctp_clear_owner_w); sctp_assoc_migrate(); sctp_for_each_tx_datachunk( sctp_set_owner_w);SKB was not in the outq, and was not changed to newsk